Threat Hunt: RoKRAT Malware - Injection and Steganography
A new RoKRAT variant tied to APT37 delivers payloads via oversized LNK shortcuts, executing a two‑stage encrypted shellcode loader that uses steganography to conceal content. The malware achieves fileless execution by injecting into trusted processes (e.g., mspaint.exe, notepad.exe) and hides C2 activity within legitimate cloud storage services such as pCloud, Yandex Disk, and Dropbox, often leveraging hardcoded API tokens. High‑level TTPs: Initial Access: Malicious LNK files in compressed archives. Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption. Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment. Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
Microsoft Sentinel (KQL)
